Lector de Feeds

MGASA-2026-0383 - Updated freerdp packages fix security vulnerabilities

Mageia Security - 8 Septiembre, 2026 - 03:47
Publication date: 08 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-22851 , CVE-2026-22853 , CVE-2026-22858 , CVE-2026-25941 , CVE-2026-25942 , CVE-2026-25952 , CVE-2026-25953 , CVE-2026-25954 , CVE-2026-25955 , CVE-2026-25959 , CVE-2026-25997 , CVE-2026-26952 , CVE-2026-33977 , CVE-2026-33982 , CVE-2026-33983 , CVE-2026-33984 , CVE-2026-33985 , CVE-2026-33986 , CVE-2026-33987 , CVE-2026-33995 , CVE-2026-27015 , CVE-2026-27951 , CVE-2026-40033 , CVE-2026-44420 , CVE-2026-44421 , CVE-2026-44422 , CVE-2026-45700 , CVE-2026-55191 , CVE-2026-55192 , CVE-2026-55193 , CVE-2026-55194 , CVE-2026-55648 Description
Updated packages bring lot of security fixes. Please see the links for additional information. References
SRPMS 10/core
  • freerdp-3.31.0-1.mga10

MGASA-2026-0382 - Updated tor packages fix security vulnerabilities

Mageia Security - 8 Septiembre, 2026 - 03:47
Publication date: 08 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-77584 , CVE-2026-77587 , CVE-2026-77638 , CVE-2026-77639 , CVE-2026-77640 , CVE-2026-77641 , CVE-2026-77642 Description
An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type (CVE-2026-77642). A NULL write after free when sending a CONFLUX_SWITCH cell fails, resulting in a crash (CVE-2026-77641). An infinite loop when decompressing a truncated zlib/gzip stream with done=1 (CVE-2026-77640). A compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams (CVE-2026-77639). A race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach (CVE-2026-77638). A use-after-free that a malicious exit node could use to crash a client (CVE-2026-77587). Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams (CVE-2026-77584). References
SRPMS 10/core
  • tor-0.4.9.11-1.mga10
9/core
  • tor-0.4.9.11-1.mga9

MGASA-2026-0381 - Updated apache-mod_auth_openidc packages fix a security vulnerability

Mageia Security - 7 Septiembre, 2026 - 19:46
Publication date: 07 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-54789 Description
Out-of-bounds read and write in state cookie parsing. (CVE-2026-54789) References
SRPMS 10/core
  • apache-mod_auth_openidc-2.4.20.2-1.mga10
9/core
  • apache-mod_auth_openidc-2.4.20.2-1.mga9

MGASA-2026-0380 - Updated python-pyasn1 packages fix security vulnerabilities

Mageia Security - 7 Septiembre, 2026 - 19:46
Publication date: 07 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-59884 , CVE-2026-59885 , CVE-2026-59886 Description
The BER decoder (shared by the CER and DER codecs) parses long-form tags by accumulating continuation octets in a loop with no upper bound on the size of the tag ID. A crafted input can force the decoder to build an arbitrarily large integer, with CPU cost growing quadratically in input size — a ~1 MB input consumes over a minute of CPU. On Python 3.11+, the oversized tag ID can also trigger an unhandled ValueError (integer string conversion limit) while the decoder formats error messages, violating the documented PyAsn1Error contract and potentially bypassing caller error handling. References
SRPMS 10/core
  • python-pyasn1-0.6.4-1.mga10

MGAA-2026-0121 - Updated radiotray-ng package fixes bug

Mageia Security - 7 Septiembre, 2026 - 19:46
Publication date: 07 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Update the stream links for "KDFC", "CINEMIX", "Radio Paradise", and remove the offline "WNAR-AM Radio" station. References
SRPMS 10/core
  • radiotray-ng-0.2.10-1.mga10

MGAA-2026-0120 - Updated tilibs & tilp2 packages fix bug

Mageia Security - 7 Septiembre, 2026 - 19:46
Publication date: 07 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
tilp2 crashes immediately at startup. This update fixes the reported issue. References
SRPMS 10/core
  • tilibs-1.19-1.mga10
  • tilp2-1.19-1.mga10

MGASA-2026-0378 - Updated mingw-expat & expat packages fix security vulnerabilities

Mageia Security - 5 Septiembre, 2026 - 05:35
Publication date: 05 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-66046 , CVE-2026-76641 , CVE-2026-76956 , CVE-2026-76957 Description
Expat Denial of Service via storeAtts() Quadratic Complexity. (CVE-2026-66046) Expat Out-of-Bounds Read via dtdCopy. (CVE-2026-76641) In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content. (CVE-2026-76956) libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. (CVE-2026-76957) References
SRPMS 10/core
  • mingw-expat-2.8.4-1.mga10
  • expat-2.8.4-1.mga10

MGASA-2026-0377 - Updated python-linkify-it-py package fixes security vulnerabilities

Mageia Security - 5 Septiembre, 2026 - 05:35
Publication date: 05 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48801 , CVE-2026-59887 Description
LinkifyIt.match() was quadratic on untrusted input when linkify is enabled (GHSA-8m2q-wq3r-6hq8). Fix quadratic complexity in LinkifyIt.match(), port of linkify-it 5.0.1 and 5.0.2 (upstream CVE-2026-48801, CVE-2026-59887) (#82) Match validators at a position instead of slicing the tail, needed because Python 3.10 does not optimize the ^ anchor (#82) Allow ; in the email name, matching linkify-it. Behavior change: a;b@example.com is now linkified (#82) References
SRPMS 10/core
  • python-linkify-it-py-2.1.1-1.mga10

MGASA-2026-0376 - Updated tomcat packages fix security vulnerabilities

Mageia Security - 4 Septiembre, 2026 - 18:53
Publication date: 04 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-59083 , CVE-2026-59084 , CVE-2026-66299 , CVE-2026-65182 , CVE-2026-65183 , CVE-2026-65637 , CVE-2026-65905 , CVE-2026-65927 , CVE-2026-66422 , CVE-2026-68525 , CVE-2026-68569 , CVE-2026-68763 , CVE-2026-73180 Description
Incorrect URL decoding in RewriteValve may allow security control bypass. (CVE-2026-59083) EncryptInterceptor requirements not clearly documented. (CVE-2026-59084) DoS via WebSocket chat example. (CVE-2026-66299) Bypass longest prefix security constraint. (CVE-2026-65182) TOCTOU when setting specific permissions for Unix Domain Sockets. (CVE-2026-65183) HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete. (CVE-2026-65637) Limited replay attack possible with DIGEST authentication. (CVE-2026-65905) RewriteValve [N] restarts at the second rule and may bypass access control. (CVE-2026-65927) Servlet role references can bypass declarative role constraints. (CVE-2026-66422) Redirect after FORM auth may bypass method specific constraints. (CVE-2026-68525) Principal lookup can fail open in some cases. (CVE-2026-68569) DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset. (CVE-2026-68763) Authenticated WebSocket session survives end of HTTP session. (CVE-2026-73180) References
SRPMS 10/core
  • tomcat-9.0.121-1.mga10
9/core
  • tomcat-9.0.121-1.mga9

MGASA-2026-0375 - Updated mbedtls packages fix security vulnerabilities

Mageia Security - 4 Septiembre, 2026 - 18:53
Publication date: 04 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-25832 , CVE-2026-35336 , CVE-2026-49300 , CVE-2026-50579 , CVE-2026-50580 , CVE-2026-50581 , CVE-2026-50583 , CVE-2026-50584 , CVE-2026-50585 , CVE-2026-50586 , CVE-2026-50587 , CVE-2026-50588 , CVE-2026-50640 , CVE-2026-50713 , CVE-2026-54435 , CVE-2026-54441 , CVE-2026-73064 Description
TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. (CVE-2026-25832) Possible buffer overflow in mbedtls_ecdh_calc_secret(). (CVE-2026-35336) X.509 CA bit forgery via invalid basicConstraints extension. (CVE-2026-49300) Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context. (CVE-2026-50579) Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake. (CVE-2026-50580) Extended master secret calculation failure ignored. (CVE-2026-50581) A 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583) ChaCha20 counter overflow can reuse keystream. (CVE-2026-50584) Incomplete context reset in mbedtls_ssl_session_reset(). (CVE-2026-50585) A potential information disclosure in TLS 1.2 servers using session tickets. If the session ticket write callback failed without setting the lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized stack memory to the peer in the NewSessionTicket message. (CVE-2026-50586) Timing side-channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587) Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing. (CVE-2026-50588) Ignored TLS 1.3 resumption secret derivation error. (CVE-2026-50640) Heap corruption with early renegotiation after corrupted record in DTLS. (CVE-2026-50713) Side channel leak in ECC optimized modp. (CVE-2026-54435) Signature algorithm restrictions not enforced on certificate chain. (CVE-2026-54441) A random generator fault can compromise TLS data integrity. (CVE-2026-73064) References
SRPMS 10/core
  • mbedtls-3.6.7-1.mga10

MGASA-2026-0374 - Updated microcode packages fix security vulnerabilities

Mageia Security - 4 Septiembre, 2026 - 18:53
Publication date: 04 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2025-31936 , CVE-2025-31938 , CVE-2026-20917 , CVE-2025-35973 , CVE-2026-20716 , CVE-2026-20760 , CVE-2026-20713 , CVE-2026-20707 Description
A potential security vulnerability for some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions (Intel® TDX) may allow escalation of privilege. (CVE-2025-31936) A potential security vulnerability in some Intel® Xeon® 6 processor with Intel® Trust Domain Extensions (Intel® TDX) may allow information disclosure. (CVE-2025-31938) A potential security vulnerability in some Intel® Processors may allow information disclosure. (CVE-2026-20917) A potential security vulnerability in some Intel® Processors may allow escalation of privilege. (CVE-2025-35973) A potential security vulnerability in some Intel® Processors may allow escalation of privilege. (CVE-2026-20716) A potential security vulnerability in some Intel® Processors may allow denial of service. (CVE-2026-20760) Potential security vulnerabilities in some Intel® Xeon® Processors may allow escalation of privilege. (CVE-2026-20713) A potential security vulnerability in some 3rd Gen Intel® Xeon® Scalable Processors may allow denial of service. (CVE-2026-20707) References
SRPMS 10/nonfree
  • microcode-0.20260812-1.mga10.nonfree
9/nonfree
  • microcode-0.20260812-1.mga9.nonfree

MGASA-2026-0372 - Updated python-gitpython packages fix security vulnerabilities

Mageia Security - 3 Septiembre, 2026 - 19:06
Publication date: 03 Sep 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-40267 , CVE-2023-41040 , CVE-2026-42215 Description
CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. CVE-2023-41040 In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. CVE-2026-42215 From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47. References
SRPMS 9/core
  • python-gitpython-3.1.50-1.mga9

MGAA-2026-0119 - Updated drakx-net packages add nl80211 (iw) scan and WPA3 (SAE) support

Mageia Security - 3 Septiembre, 2026 - 19:06
Publication date: 03 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
Our drakx.net packages still depended on deprecated wext (iwlist), causing problems with finding and connecting to networks for several users. This update adds both nl80211 (iw) scan and WPA3 (SAE) support, thus fixing the issues. References
SRPMS 10/core
  • drakx-net-2.65-1.mga10
9/core
  • drakx-net-2.65-1.mga9

Potions in Mageia. 03 – Elograf or how have voice dictation with Mageia

Blog de Mageia (English) - 3 Septiembre, 2026 - 08:50

Have you ever needed voice dictation but couldn’t find a way to do it on Linux? Mageia offers Elograf with everything you need to get it working with just a few clicks. Let’s get started!

Tutorial – Installation

From our Mageia repositories

Since the release of Mageia 9, installing Elograf from our repositories is as simple as selecting the application from the package manager from “Install and remove applications” in the start menu or by entering the Mageia Control Center (MCC), and Mageia will install all the necessary packages to make Elograf fully functional, including kaldi, voxk-api, and nerd-dictation.


Voice model installation


The program requires a voice model function. This model is specific to each language. The available models are listed on this page. The tests were performed using one of the extended models from the link mentioned above. These models can also be downloaded directly from Elograf and can be saved in either user or system space (root password required for this option).

Use

When you launch Elograf from the Mageia application menu, a microphone icon will appear in the system tray, which is disabled by default. Clicking the icon will activate Elograf and begin voice dictation.


Right-clicking displays a menu that allows you to start dictation or access the settings. The settings menu shows options for adding models both locally, by downloading the file from the aforementioned link and specifying the saved location, and online. In the latter case, Elograf will open a list of available models for download and prompt you to choose the installation location, offering the option to install it in the user’s space or the system space from the same window.


By choosing “Activate direct click on the icon”, the start of dictation is controlled by a left click on the icon.

It is recommended to add Elograf to the list of applications set to run automatically at system startup. This will add its icon to the system tray, allowing quick access to commands. The method for configuring this option depends on your desktop environment.

After these settings, you can go to the application where you would normally write text, such as Libreoffice Writer, place the cursor where you want to start and begin dictating. At launch, you may have to wait a little while before the first vocalizations are recognized; this is the template’s loading time.

Some of the advantages you can find with this application:

  • Offline dictation. Voice recognition is performed using Vosk and locally downloaded models, so there’s no need to send the audio to a cloud service. This provides privacy and allows dictation even without an internet connection.
  • Works in almost any application. The recognized text is entered into the currently active application, so it can be used in text editors, browsers, email, forms, etc.
    • Saving on text when writing long texts. Speaking is usually faster and more comfortable than typing large amounts of text, especially for drafts, notes, emails, or documents.
    • Reduced keyboard usage. Especially useful when you want to decrease continuous keyboard use or alternate between typing and dictation.
    • Control from the system tray.
    • A selection of different downloadable language packs.
    • Simple setup, compatibility with X11 and Wayland (For Wayland, the keyboard emulator should be set to “DOTOOL” in the “Advanced settings”, with the keyboard specified.
    • Open source.

    More information in our Wiki!: Voice recognition in Mageia.

    Categorías: Blogs Oficiales

    Pociones en Mageia. 03 – Elograf o como tener dictado por voz con Mageia

    Blog de Mageia-ES - 3 Septiembre, 2026 - 08:47

    ¿Has tenido la necesitad de disponer de dictado por voz pero no has encontrado la forma de hacerlo en Linux? En Mageia tienes Elograf con todo lo necesario para hacerlo funcionar a golpe de clic. Vamos con el proceso!

    Tutorial – Instalación

    Desde nuestros repositorios de Mageia

    Desde el lanzamiento de Mageia 9, la instalación de Elograf desde nuestros repositorios es tan sencilla como seleccionar la aplicación desde el gestor de paquetes desde “Instalar y quitar aplicaciones” en el menú de inicio o entrando al Centro de Control Mageia (MCC) y Mageia instalará todos los paquetes necesarios para que Elograf sea completamente funcional, incluyendo kaldi, voxk-api y ner-dictation.

    Instalación del modelo de voz

    El programa necesita un modelo de voz para funcionar. Este modelo es específico para cada idioma. En esta página se enumeran los modelos que están disponibles. Las pruebas se han realizado con uno de los modelos extendidos el enlace mencionado anteriormente. Estos modelos también se pueden descargar directamente desde Elograf, y pueden guardarse tanto en el espacio del usuario, como en el espacio del sistema (se solicitará la contraseña de root para esta opción).

    Uso

    Al iniciar Elograf desde el menú de aplicaciones de Mageia, aparecerá un icono en la bandeja del sistema en forma de micrófono, que aparece como desactivado por defecto. Pulsando en el icono, se activará Elograf para comenzar el dictado por voz

    Con un clic derecho, se muestra un menú que permite iniciar el dictado o acceder a la configuración. En la Configuración se muestran las opciones para añadir modelos tanto localmente, descargando el archivo desde el enlace antes mencionado e indicando la ruta donde se ha guardado, como de forma online, donde Elograf abrirá una lista con los modelos disponibles para descarga y solicitará la ubicación de instalación del modelo ofreciendo también la opción de instalar en el espacio del usuario o en el espacio del sistema desde la misma ventana.

    Al elegir “Activar clic directo en el icono”, se controla el inicio del dictado con un clic izquierdo en el icono.

    Es recomendable agregar Elograf a la lista de aplicaciones con ejecución automática en el inicio del sistema. Esto agregará el icono en la bandeja del sistema, permitiendo acceder rápidamente a los comandos. El método de configuración de esta opción, depende del entorno de escritorio.

    Después de estas configuraciones, puedes ir a la aplicación donde normalmente escribirías texto, como por ejemplo Libreoffice Writer, colocar el cursor en el lugar donde quieras empezar y comenzar a dictar.

    En el lanzamiento hay que esperar un poco antes de que se reconozcan las primeras vocalizaciones, este es el tiempo de carga del modelo.

    Algunas de las ventajas que puedes encontrar con esta aplicación:

    • Dictado sin conexión a internet. El reconocimiento de voz se realiza mediante Vosk y los modelos descargados localmente, por lo que no es necesario enviar el audio a un servicio en la nube. Esto aporta privacidad y permite dictar incluso sin conexión.
    • Funcionamiento en casi cualquier aplicación. El texto reconocido se introduce en la aplicación que esté activa, de modo que puede utilizarse en editores de texto, navegadores, correo, formularios, etc.
    • Ahorro de textos al escribir textos largos. Hablar suele resultar más rápido y cómodo que teclear grandes cantidades de texto, especialmente para redactar borradores, notas, correos o documentación.
    • Reducción del uso del teclado. Especialmente útil cuando se quiere disminuir el uso continuado del teclado o alternar entre escritura y dictado.
    • Control desde la bandeja del sistema.
    • Elección de diferentes modelos de idioma descargables.
    • Configuración sencilla, compatibilidad con X11 y Wayland (En el caso de Wayland, el emulador de teclado debe configurarse como «DOTOOL» en la sección «Configuración avanzada», indicando el teclado correspondiente).
    • Código abierto.

    Más información en nuestra Wiki: Reconocimiento de voz en Mageia

    Categorías: Blogs Oficiales

    MGASA-2026-0371 - Updated bubblewrap package fixes security vulnerabilities

    Mageia Security - 2 Septiembre, 2026 - 17:59
    Publication date: 02 Sep 2026
    Type: security
    Affected Mageia releases : 10
    CVE: CVE-2026-87766 Description
    Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup References
    SRPMS 10/core
    • bubblewrap-0.12.0-1.mga10

    MGASA-2026-0370 - Updated perl-Text-CSV_XS packages fix a security vulnerability

    Mageia Security - 2 Septiembre, 2026 - 17:59
    Publication date: 02 Sep 2026
    Type: security
    Affected Mageia releases : 10 , 9
    CVE: CVE-2026-7111 Description
    Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. References
    SRPMS 10/core
    • perl-Text-CSV_XS-1.640.0-1.mga10
    9/core
    • perl-Text-CSV_XS-1.640.0-1.mga9

    MGASA-2026-0369 - Updated libalsa2 packages fix security vulnerabilities

    Mageia Security - 2 Septiembre, 2026 - 17:59
    Publication date: 02 Sep 2026
    Type: security
    Affected Mageia releases : 10 , 9
    CVE: CVE-2026-25068 , CVE-2026-56109 Description
    alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. (CVE-2026-25068) ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c. (CVE-2026-56109) References
    SRPMS 10/core
    • libalsa2-1.2.15.2-1.1.mga10
    9/core
    • libalsa2-1.2.9-1.1.mga9
    Feed